CVE(s) found in v0.21.12

[github-actions]

Latest lifecycle release v0.21.12 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/lifecycle/actions/runs/27926732408 json: {
"id": "GO-2026-4610",
"severity": "High",
"description": "Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli"
}
{
"id": "GHSA-xhf5-7wjv-pqxp",
"severity": "High",
"description": "containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull"
}
{
"id": "GHSA-jpcc-p29g-p8mq",
"severity": "Medium",
"description": "containerd image-triggered runtime DoS via unbounded group parsing"
}